[fel64]

Not sure who reads the WP feeds, so here’s an interesting snippet:

Mullenweg says he’ll use the new cash to fund more projects, including a new forums product. Called TalkPress, he said it will be “smaller, lighter, with fewer features but a richer customization API.”

In other words, it will work a lot like WordPress, which is a basic framework upon which users add the features they really need. Mullenweg some time ago created a forum program, BBPress, and the TalkPress service will be built on that.

“I spend a lot of time on forums, and they drive me crazy,” he said. “They haven’t changed in 10 years.”

http://blogs.chron.com/techblog/archives/2008/01/the_importance_of_being_matt.html

[fel64]

And woop, backpress.

https://trac.bbpress.org/changeset/1076

backPress: BOOM! this will break *everything*

Things be happnin’.

[_ck_]

Ah I see we both noticed it at the same time.

(started another topic without realizing)

[bruz]

Thanks for the trac-thing fel64, I just wonder what the actual name will be – backPress for the open-source-package, talkPress for the hosted-solution? Because there is “backPress” all over the 1076 revision now…

[_ck_]

Should build 1075 be treated as the last relatively stable build for now?

Any chance of a 0.84 release with all the pre-backpress fixes?

(why does dev use a 1990’s-style mailing list for it’s own *forum* software?)

[Sam Bauers]

Things may be a bit confusing at the moment with two new and different names flying around. I’ll do my best to clarify things and we can use this topic for everyone to ask questions on the subject and provide input.

For those who are interested, the first thing to do is read this post (and the articles it links to) in the blog:

The future for bbPress

That post is pretty vague about things. So let me be more specific here. First, I’d like to make it clear that bbPress is not being replaced or abandoned or drastically changing direction. As for the two new names that have been mentioned, I’ll cover them below.

BackPress:

bbPress has a lot of shared code with WordPress. BackPress is the name of a new project which is attempting to normalise this shared code into a set of generic files that will simply plug in to both projects (and potentially others). This allows us to leverage the testing and improvements made to this shared code without the overheads of manually merging changes. This way we can spend more time on bbPress’ unique code and extending new functionality.

TalkPress:

It has been public for a while that Automattic intends to create a hosted forums service based on the bbPress project code. The intention is to make this work much like the existing WordPress.com hosted service for blogs. Matt Mullenweg let it slip that the working name for the project (and not necessarily the service) is TalkPress. We probably won’t talk much about it here, but I can say that the majority of the code written to create this new project will be released as open source. Regardless of the name of that service when it launches, the name of this project, “bbPress”, will not change.

As for the upcoming work for bbPress, I’m happy to elabrorate here:

bbPress code:

Along with the inclusion of BackPress into trunk, there are other things going on. We are in the process of implementing a new taxonomy structure for tags. Improving bbPress’ object cache to make it compatible with various WordPress object cache plugins. Replacing the fairly ordinary “favourites” system with a much more flexible and useful topic aggregation tool, and later on we will be incorporating a set of functionality based around the XML-RPC tools available in WordPress such as pingbacks and trackbacks.

bbPress.org website

The bbPress.org website is due for a clean up. Most importantly, the extend area will be upgraded to include a plugin repository similar in functionality to the one that exists on the WordPress.org website. There is a possibility that we will also launch a theme repository based on the same system. A little later on, we plan to re-design the whole site.

I hope this clears things up a little and I’m happy to answer any questions here. I can’t think of anything, but it’s possible that there may be some things that I can’t say about the hosted service project. Feel free to ask though.

[_ck_]

Thanks for taking the time to write that up.

I guess my biggest question for now is if build 1075 should be treated as the most relatively stable build for alpha users.

I’ll say this to the day I abandon bbpress – adding trackbacks/pingbacks to it is the biggest waste of limited time and resources and will make the program the spammers target of choice while leaving it with the worst reputation.

ps. if Matt held some kind of contest I am sure a better name could be come up with than “TalkPress”. The problem is he wants to stick to that “press” suffix which implies a one-way communication for a something that is specifically for two-way interaction.

[Sam Bauers]

You are right, 1075 is probably the most stable release for “cutting-edge” users, but we would appreciate testing of trunk during integration of BackPress.

We do intend to experiment with PingBacks and TrackBacks in topics via XML-RPC, and you could be right about spam, but we won’t know until we try. We will build out the spam tools provided by Akismet to try and meet the challenge of spam at the same time. There are also other ways in which we can utilise XML-RPC besides those two features which you may not have considered, we already have some cool ideas about user integration and content aggregation that should be driven by the needs of the hosted project. I hope you don’t leave us just for giving it a whirl

The “Press” names are mostly about branding and the they need not be taken literally. We can leverage a lot of good-will by associating with WordPress, and we intend to create better ways to integrate the two projects, regardless of where they are installed or hosted.

[_ck_]

I’ll probably be forced to join the dev list to try to solve this but I just tried moving from 951 to 1075 and I cannot get the logins to “stick” (ie. logs in and then acts as if it is not logged in)

Seems like the old cookie path issue but I’ve looked the cookies and the code and everything seems healthy. Even created a new user with 1075 and that user cannot login either.

eta: 1006 does not exhibit the login issue

ps. don’t kid yourself with Akismet stopping spam. Spammers just escalate their deviousness on what they can get through it. My wordpress.com blog gets spam almost daily now, bleeding right through Akismet. And Akismet hasn’t been given peer-review for privacy/security issues such as passing every single message entered on every single blog and bbpress through automattic – even for private posts and private sub-forums. Won’t make for good headlines when people start to think about it.

[Sam Bauers]

You know that both cookie and password hashing have changed? You may need to clear your old cookies manually to make way for the new ones. Send a mail to the dev list or hit us on IRC in the #bbpress channel and well work out what’s going on.

We’re acutely aware of how spammers attempt to “fool” Akismet. There are steps being taken now to help improve the processes involved in combatting this. Remember that we are users of Akismet too, so have an interest in keeping it ahead of the game.

The nature of Akismet’s purpose means that back-end code needs to remain closed. If spammers knew how it worked, it would likely make it possible for them to game the system. Of course it is opt-in, so if you don’t like it then you don’t have to use it. Controlling the data that is passed to Akismet is controllable from the client end using plugins that can limit it’s behaviour. These already exist for WordPress, bbPress ones could be easily developed too. If there are hooks missing to make that possible then we’ll add them.

[_ck_]

Ugh, so an existing forum with 1000 users will have to instruct every single one to clear their cookies – meaning at least 50% won’t understand and try to contact the forum operator personally.

I think there is a better way – perhaps an upgrade plugin that can detect the out of date hash and instruct the client to delete the old cookie and redirect back to the login.

Actually, wouldn’t bbpress replace the hash data in the cookie upon login? None of this sounds right – I created a new user under 1075 and was still unable to login.

I’ve gotten build 1006 to work properly so I guess I will try another investigation into the upgrade from there tonight. I wonder if this has to do with the hard coded hash I have set in bb-config.php

How does this affect a setup with a shared login from wordpress where you have to match the same hash it has? I had the integration working just right, hope there was a good reason to fiddle with it.

[chrishajer]

Sam, I think this should be made sticky. For a while, the conventional wisdom was to tell people to grab the latest trunk to fix the underscore plugin issue and the mysqli issue, but that’s no longer true. There is no good reason for a non-developer to use trunk at this point, I don’t think. Is the best advice for people who just want to install a working version of bbPress to use r980, as you posted about a month ago, or has that advice changed?

Thanks,

Chris

[fel64]

XML-RPC sounds fairly interesting; I’d like to see what you’ll do with it apart from pingbacks. Content aggregation sounds good too. Is there anything you can say about backPress, though? Do you have any idea for when you’ll maybe be splitting it into BackPress and bbPress?

(why does dev use a 1990’s-style mailing list for it’s own *forum* software?)

Because while forum software is a communication medium it’s not necessarily the right one for development talk. But you’ve brought it up many times now; maybe time to give it a rest?

[Sam Bauers]

> so an existing forum with 1000 users will have to instruct every single one to clear their cookies

Not necessarily, it just may be an issue if your cookies weren’t expired already.

> I wonder if this has to do with the hard coded hash I have set in bb-config.php

> How does this affect a setup with a shared login from wordpress where you have to match the same hash it has?

You will need to also run WordPress trunk to match the cookies and hash methods up. WordPress has also migrated their cookies and password hashes in trunk.

> hope there was a good reason to fiddle with it

Judge for yourself, we followed WordPress’ lead:

https://trac.wordpress.org/ticket/5367

[Sam Bauers]

@ _ck_

I suggest you try a new test install of both bbPress and WordPress integrated to see the way the auth and secrets are supposed to match up in a “clean” environment. You should be able to adjust things in your existing installation as a result.

[Sam Bauers]

@ chrishajer

Whenever I have linked to trunk in the past I have always mentioned and or linked to specific revisions, so I don’t think this is a major issue. I’ll stick it to the top so that it is obvious to people anyway.

[Sam Bauers]

@ fel64

BackPress is already a separate repository which is linked to externally within the bbPress trunk.

For interests sake the BackPress repository is here:

http://svn.automattic.com/backpress

BackPress has no separate Trac though.

[_ck_]

Thanks for the background Sam. For a moment I panicked about the cookie hash vulnerability as I have legacy WP 2.1 (and bbpress 0.81) installs that are too customized to upgrade (I hack security fixes in manually) but then I read this:

*If* an attacker can gain read access to the wp_user table, for example due to a publicly visible backup or SQL injection vulnerability, a valid cookie can be generated for any account.

You’ve got bigger problems if an attacker can do a SQL injection or has access to your mysql backup. But I can definitely understand why they replaced it. Who the heck figures these vulnerabilities out though, wow.

Since bbShowcase is stand alone bbPress (for now) I’ll give the upgrade another shot later and try to understand what’s going on with the cookies/login.

I take it that 0.8.3.1 doesn’t use the new cookies though? At some point you might need to release 1075 as 0.8.3.5 or something like that?

[_ck_]

Whew, after a bit of debugging I found the cookie issue with builds >1008 – and it was all my fault – my apologies!

I finally noticed in the changes from 1008 to 1009, that pluggable.php changed the functions that set the cookies. Then I had a sudden recall where I made an auto-load plugin to force year-long cookies (_cookie-year.php) which was now interfering with the function. Deleting the plugin allowed the logins to work.

So anyone that happens to be using _cookie-year.php will have to replace it when I get time to make an update.

[chgogrrl99]

I don’t know exactly what you guys are talking about, but I fear it means I’ll have to start all over, doesn’t it?

[fel64]

No, not really. It seems likely to me (as an outsider) that a regular upgrade process will continue to work for you.

[Sam Bauers]

@ChgoGrrl99

We’ll be attempting to make future upgrade processes as seamless as possible.

[_ck_]

As I was reverse integrating the WP trunk with the bbPress trunk this weekend I was thinking a lot more about this – and the more I think about it, the more I am getting confused about what is being planned.

If WP and bbPress are being coded to use to a unified function library that would definitely break wordpress hooks. But Matt would never do that as it would break 1000’s of plugins and themes for the far more popular WordPress.

In some ways, bbPress’s db/load process and hooks are slightly more thought out/evolved than WordPress because they came later and WordPress has to maintain some backward compatibility.

So then it occurred to me that to leave the WP hooks alone, I hope you are not trying to replace the core of bbPress only with WP-like functions? I don’t see how that could be done without breaking every single plugin and theme for bbPress? Will the next (non minor) release of bbPress have a nearly-unified WP core?

In trac I see BB functions being renamed to their WP counterparts. But no wrapper functions for backward compatibility are being written. I see the backend of bbPress being hammered into backPress and I imagine the next bbPress as simply a front-end being re-written to only use the backPress, ie. wordpress, hooks.

So I guess the final question is: is there a plan to write wrapper functions or is the general attitude just to abandon all third party work to date for the next bbPress release and just hope we go along for the ride?

[Sam Bauers]

I don’t think the concept of upgrading plugins to met the new requirements of a version is unheard of or that big a deal.

Most deprecated functions will probably be maintained via the deprecated.php include file, but we are actually considering clearing out most of that deprecated.php include when 1.0 is released.

We have generally searched the current plugin repository for each of the few functions we have dropped so far during the BackPress migration. If we don’t find it we have been reasonably confident that dropping the function won’t cause any problems.

We will attempt to work with the current plugin devs to get their plugins up to scratch when the time comes.

[Sam Bauers]

Also, BackPress may or may-not be incorporated into WordPress. bbPress is a testing ground for the concept. If it doesn’t get incorporated into WordPress it doesn’t really matter, hopefully we’ll at least have a better structured core in bbPress as a result.

[lenen]

Looks like a lot of trouble to fix in the future. I never had any problems with bbPress, but that’s probably because there aren’t a lot of users active